Rules in Heaven : A closer look at a set of regulations for air navigation service from a Resilience Engineering perspective

(1)

MAGISTRATE THESIS IN COGNITIVE SCIENCE

RULES IN HEAVEN

A closer look at a set of regulations for

air navigation service from a

Resilience Engineering perspective

Mimi Axelsson 2011-12-07

Department of Computer and Information Science Linköping University

Supervisors: Rogier Woltjer, Billy Josefsson, Fabian Segelström Examiner: Arne Jönsson

(2)

(3)

iii

Acknowledgements

This study has been supported by LFV the Swedish air navigation services. I would like to thank LFV for believing in me and giving me this great

oppor-tunity to study the domain that has fascinated me since the very first time I

en-countered it.

This thesis would not have been possible to write without great support and advise from my leading and very patient supervisor Rogier Woltjer to which I would like to express my sincere gratitude. Furthermore I give special thanks to Fabian Segelström at Linköping University for his excellent navigation through the jungle of research methods.

It is with deep gratitude that I thank Billy Josefsson and Mats Tornvall at LFV, for making this explorative study possible and giving me the access to valuable information and the personnel at the air traffic service units. I would also like to express my thanks to all of the respondents that have taken part in this study. They have shown interest in my study and despite being busy navigating air-craft, they have dedicated me a lot of time and welcomed me with open arms to their workplaces. A special thanks goes to the patient air traffic controllers who participated in the follow- up interviews.

Finally, I wish to express my greatest thanks to my dear family and friends who have supported me during this whole period of intense writing. The encour-agement and feedback sent from my student colleagues Johanna Larsson, Tho-mas Kaspersson and Joel Johansson in the Tho-master room at Linköping Univer-sity, have always strengthened me to believe in me and the study as a whole.

Karlstad, December 2011 Mimi Axelsson

(4)

(5)

v

Abstract

Air Traffic controllers are responsible for navigating aircraft and sustaining a safe and efficient traffic flow in a four-dimensional air space. They apply separation rules to keep aircraft apart from each other and their well-coordinated work and complete awareness of risks have made possible the combination of increased traffic intensity and strong safety records. Rules and procedures make up a significant part of the work and the locus of this study was to examine how the air traffic controllers, employed at the Swedish state enterprise LFV, perceive their current set of regulations. At each Traffic Service Unit operators are equipped with two operations manuals, and a particular fo-cus was put on the design, use and management of the manuals.

Furthermore, this study involved two observation sessions in two Air Traffic Service Units and twelve interviews with operators and domain experts. With the aid of the theory of Resilience Engineering, four essential functions have been identified in order to account for the underlying and interconnected func-tions behind rule implementation: monitoring, learning, anticipation and respond-ing. Thereafter, each function has been divided into sub-categories that all are aimed to describe in what ways, individual as organizational, current rule man-agement supports the air traffic controllers.

Based on the results of this study, it can be concluded that there is need for a reorganization of the set of regulations at LFV, and that the maintenance of the operations manuals has been reduced because of constrained resources. An ad-ditional factor, which complicates the possibility to change the procedures, is that a major part of the content originates from international regulations. In ad-dition, this thesis claims that safe and successful use of rules depends on more than the physical look and design of the operations manuals. Therefore, support of current set of regulations will be discussed in terms of document distribu-tion, educadistribu-tion, communicadistribu-tion, purpose of procedures and approaches to rule following.

(6)

(7)

vii

Figures

Figure 1 Structure of the Rule Management ... 8

Figure 2. The Sharp–end and blunt-end relations. Adapted from (Woods et al., 1994) ... 12

Figure 3. The chart of interactions and couplings. Adapted from (Perrow, 1984) ... 13

Figure 4. The distribution of extracts found in one of the visited aerodrome controls... 35

Figure 5. The Sharp and Blunt end applied on the Rule Management ... 47

(10)

x

Terminology

AIP Aeronautical Information Publication

Dhb ANS Operations Manual for Air Navigation Services Drifthandbok ANS

ATS Dhb Operations Manual for Air Traffic Services ATS Drifthandbok

ATC Air Traffic Control Flygkontrolltjänst

ATCO Air Traffic Controller Flygledare

ATS Unit Air Traffic Service Unit Enhet för Flygtrafikledningsen-het

ATM Air Traffic Management Flygledningstjänst

BFL Ordinances for Air Navigation Services Bestämmelser för Luftfart

CAA Swedish Transport Agency, Swedish Civil Aviation Authority

Transportstyrelsen, Luftfartsav-delning

CCC Common Core Content

DA Operational deviation report Driftavvikelse

EASA European Aviation Safety Agency

EPN Entry Point North

EU European Union Europeiska Unionen

ICAO International Civil Aviation Organization

IFR Instrument Flight Rules

LFS Ordinance Föreskrifter från före detta

Luftfartsstyrelsen

NUAC Nordic Unified Air Traffic Control

OMA Operational Message from Unit Management Operativt Meddelande från Arbetsledningen

SERA Standardised European Rules of the Air

SUPP Supplement

SMS Safety Management System Ledningssystem

TSFS Ordinance Föreskrifter från Transportstyrel-sen

QA Quality deviation report Kvalitetsavvikelse

(11)

1

1 _Introduction

Aviation is a safety-critical domain often compared to complex socio-technical systems such as oil platforms and nuclear power plants. Aircraft transport hun-dreds of human lives at high speeds, rushing in four-dimensional space that never can be fully monitored. The margins are optimized and the smallest mis-takes result in economical or human loss. Yet current air transport systems can show an impressive safety record. The statistics from 2009, taken from Aviation Safety Network (www.aviation-safety.net, 2011), report 30 airliner accidents with 757 people killed. The number of victims was the lowest in sixty years but also lower than the average number of the preceding ten years which was 802 victims.

Regarding the question of how flight safety can possibly match the critical con-ditions there is one answer, awareness of the potential for disaster and a well- coordinated and monitored air space, more precisely the service of Air Traffic Control. Air traffic controllers (ATCO’s) are concerned with the main task to ensure that the aircraft never exceed the separation restrictions, in order to or-ganize a smooth traffic flow in the air and on the ground (Felici et al., 2008). Through calculations of permitted altitude and longitude, the controllers sepa-rate the aircraft vertically and horizontally. Operators are often geographically far away from the world they are expected to control and can only do so with the aid of technical devices that illustrate and communicate with the aircraft. Consequently, there are high demands on the distribution of work that ranges over time, space and organizations. A strict and standardized approach to the performance of actions is required to cope with such a dynamic reality and it is not a coincidence that Air Traffic Management is recognized for being a domain based on standards and procedures (Felici et al., 2008).

It is not only acknowledged that rules contribute to the control of system safety, but also that rules formulated in the wrong way or constituted for the wrong reasons may jeopardize safety in dangerous situations. The world that is moni-tored consists of an uncountable amount of factors that interact in unexpected ways and give rise to the unstoppable generation of unique situations. Despite the existence of an extensive set of regulations, many situations can never be fully covered by the procedures. There is a gap between procedures and prac-tice that always will remain. Yet there is surprisingly little research on how this should be done in order to increase their purpose and to decrease the gap (Hale et al., 2003).

(12)

2

LFV, a Swedish provider of air navigation services has raised the question of whether their set of regulations is formulated in a well-functioning way and if it supports the work of the air traffic controllers. Administration and develop-ment of the set of regulations has undergone changes in the last years due to reorganization of the Swedish aviation authorities and cooperation with inter-national aviation actors. This has, in combination with limited resources to regulate and monitor the set of regulations, led to a constant growth of the total collection of procedures.

1.1 Purpose

The purpose of this study is to explore how air traffic controllers employed by LFV experience the current set of regulations formulated in the operations manuals. The study aims at providing an analysis that from an organizational point of view seeks to describe in what ways the rule management has an effect on the actual implementation of procedures in practice. This is regarded as an exploratory study that will show if it is relevant to start a detailed and more ex-tensive investigation of the problem area.

Observations and interviews focus on examining the following questions in or-der to meet the purpose of the study:

- How are the operation manuals administrated in terms of formulation, revi-sions and updates?

- How do the operators perceive the content and the structure of the operations manuals?

- In what ways does the organization support the operator’s application of rules?

1.2 Clarifications and Restrictions

The study has a qualitative approach and aims to, if results reveal issues with the current set of regulations, present samples of opinions and specific matters within the problem area. It is not of interest to map or account for all possible topics that may underlie these issues. With respect to time constraints and the extent of the thesis, the survey involves two of the sites for air navigation serv-ices that are run by LFV. The results based on observations and interviews can therefore not be generalized as opinions shared by all air traffic controllers or domain experts employed by LFV nor the organization as a whole.

(13)

3

2 _Background

The organization, earlier called Luftfartsverket was shaped in 1978 thanks to the integration of civil- and military air traffic. The solution to combine the air navigation services was and still is rare in Europe. In April 2010 the

organization was divided into two parts, namely the new LFV with the remaining mission to supply air navigation services, and the government company Swedavia that operates the Swedish state airports. LFV Group is today a state enterprise with sales that exceed SEK 2 billion. LFV, with its

estimated 1400 employees, provides air navigation service to customers in more than 40 locations in Sweden and has its headquarter in Norrköping, Sweden. LFV is considered one of Europe’s leading actors in air navigation services with its primary target to provide a safe and cost-effective navigation which is

strongly affected by the goals concerning minimization of environmental impact.

LFV operates air traffic service units in a number of different areas:

Aerodrome Control Service is the control where operators execute departures

and receive approaching aircraft from the approach control. This also includes the responsibility to monitor the movement on the ground and to avoid

conflicts between vehicles to and from the gate and runway. The duties are often divided among the operators when working in pairs. For instance, the ground controller has responsibility for the taxi management while the local controller handles the take-offs and landings.

Approach Control Service is concerned with the area around an airport and air

traffic controllers manage the departing and arriving phase of each aircraft. After take-off, once an aircraft is separated from the next aircraft, it will be received from the aerodrome control. The air space is divided into sectors in which the operators organize the traffic via a radar screen. Aircraft that climb and leave a certain section will be handed over to the area control.

(14)

4

Area control Service, also called en route flight phase, deals with aircraft

cruising in the upper air space. Area control operators guide the flights through sectors that often are adjacent to international territory. The size of each sector can be adjusted according to the number of operators in position and the intensity of traffic. When traffic requires duties are to be split among the operators, the planning controller monitors the sector and assists an executive controller with information while the executive controller coordinates the aircraft and guides them to and from adjacent sectors (Felici et al., 2008). The two Area Control Centers (ACC) are located close to Malmö Airport and Stockholm Arlanda Airport.

2.1 Safety

LFV takes yearly more than 600,000 flights through the Swedish air space and has the vision to be a leading supplier of tomorrow's air navigation service in Europe. For LFV, safety has the highest priority and is defined as “the freedom from unacceptable risk”. A central part of the safety work is the concern for the human factor, and how human performance contributes to the performance of the entire system. The viewpoint also influences accident investigations where the function of the system is of great interest rather than the performance of a single operator. In order to identify risks and minimize them (as low as

reasonably practicable and to an acceptable level) the work at LFV is manifested in a Safety management System (SMS) that will be summarized in the

following four bullets: (www.lfv.se, 2010) 1. Organization and Safety Culture

Every employer at LFV is responsible to contribute to the safety in everyday work. Also, the manager’s role is very important since they need to encourage and facilitate the growth of a safety culture and to provide the organization with resources and competence.

2. Proactive Safety – “Think Ahead”

LFV is aiming to discover and minimize risks and weaknesses before they become problems. In practice this is realized through systematic risk assessment before introducing or changing systems; analyzing trends and problem areas; and international and national cooperation in order to develop and implement methods.

(15)

5

3. Continuous Improvement – “Lessons Learned”

Everyone within LFV has the obligation as well as the right to report any deviation from normal procedures. The occurrence reporting system (see 2.1.2) with a history of thirty years is witness of a well-established safety culture, since the number of reported incidents has increased. Through careful

identification and analysis of the deviations, causes can be found and measures can be taken to prevent recurrence of the fault.

4. Monitoring

On a regular basis, LFV conducts safety audits to monitor the control system and ensure that it is reliable. With internal follow-ups of the air safety, LFV also makes sure that the goals are achieved.

2.2 Synergi and Trend Analysis

The occurrence reporting system Synergi used at LFV is divided into two channels that each concerns a specific kind of report. Operational work such as incidents, technological issues or uncertainties about the manual will be

mediated through operational deviation reports (DA), while organizational issues, for instance work methodology and routines, or alternatively

certification and documentations, are to be expressed through quality deviation reports (QA). The system is based on a digital platform and reached from the employee's personal account on the intranet. The responsibility to evaluate a report once it has been sent away is laid on the chief of operations at each navigation site. Reports that require further investigation will be sent to Transportstyrelsen within 72 hours.

Some reports are examined with the aid of Trend Analysis

(www.transportstyrelsen.se, 2010), a method developed in order to realize the cornerstones of the Safety Management System. LFV has a proactive approach that is manifested trough three concepts: background, follow-up and

development. It is based on the idea that investigations will be concerned with different types of events rather than a certain deviation report. Therefore, events are categorized according to the area in which they occurred and thereafter divided into the part of the system they may be related to. An example of such an area is so-called the runway incursions. Based on this categorization,

(16)

6

2.3 Entry Point North

Air Traffic Controllers are educated at the Scandinavian training academy Entry Point North (EPN) located at Malmö Airport. The education is a collaboration between Naviair (Denmark), Avinor (Norway), and LFV. EPN is certified according to European guidelines and follows the Common Core Content (CCC). Eurocontrol constitutes the guidelines of CCC with the purpose to ensure that students obtain the same basics knowledge within air traffic services. Students are taught the international set of regulations collected in Documents and Annexes constituted by ICAO and the education is held in English. LFV is primarily involved with the latter part of the education that concerns certification and employment at a local navigation site within Sweden. During this latter phase the students are introduced to the national set of

regulations; the content of the two operations manuals. Time reserved to study the national rules ranges from four to five weeks and depends on which air navigation service unit the students enter. After this introduction a period of authorization follows at the navigation site. The duration differs from four months to half a year and depends on the size of the navigation site as well as the student’s individual capacity to absorb the new environment. Also, the time of the year plays a significant role; the winter period is mostly concerned with regular traffic, while the control during the summer deals with less flights

compared to the winter period.

2.4 Operations Manuals

Air traffic controllers employed at LFV are currently equipped with two opera-tions manuals in which the set of regulaopera-tions for air navigation services is for-mulated. As a part of the required certification in 2005, each unit of navigation services in Sweden needed to have an operations manual. It was discovered that the major part of the content was equal and LFV decided in agreement with Transportstyrelsen to design one common central manual for the whole territory. The operations manual for Air Navigation Services (Dhb ANS), hence-forth addressed as the central manual, contains (like the name implies) those rules that concern the entire air space of Sweden. The binder initiates with a ta-ble of contents that accounts for the disposition of the manual, namely the six parts in which it is divided into. Each part in turn contains a certain number of chapters, whereas the first part accounts for each chapter’s content. Part Three which deals with the services of air traffic management, is the most extensive one whereupon another sublevel has been introduced called 18 sections that

(17)

in-7

stead are split into chapters. The table of contents is followed by an explanation of the concepts and abbreviations that figure in the manual. The explanation is organized in alphabetic order. Variations such as geographical aspects and traf-fic flow, that have to be taken into consideration when running the services, are caught by the operations manuals for Air Traffic Services (ATS Dhb), hence-forth called the local operation manual. The local manual usually follows the same division of content as the central manual.

The operations manuals are updated several times each year because of the in-troduction, revision and elimination of regulations. The procedures are formu-lated in supplementing documents before they become official publications and enter the bindings in which the regulations are found. Changes regarding the central operation manual are called supplements (Supps) while changes in the local manuals that treat local restrictions, reminders, and methodological issues are named as Operational Message from Unit Management (OMA).

2.5 The Origin of Regulations

LFV maintains a high degree of cooperation with international organs, includ-ing the United Nations’ agency for international air navigation the International Civil Aviation Organization (ICAO), European Union (EU), EUROCONTROL and Nordic Unified Air Traffic Control (NUAC). Years of experience and inter-national cooperation has resulted in an extensive set of regulations at LFV. Therefore, the structure of the current set depends partly on a international col-laboration and partly on a historical reorganization of the Swedish aviation authorities.

The former LFV did initially hold the position as provider and regulator of the air traffic services in Sweden. Luftfartsinspektionen was theoretically inde-pendent and posed the role as regulator, but did at the same time belong to a part of LFV and served under the same executive. However, the construct did not respond to the European Union's requirements regarding concurrence on the market and led to a separation of the responsibilities. Luftfartsstyrelsen was introduced as the regulator of LFV, which remained as the provider of naviga-tion services. The by then existing set of rules was reviewed and moreover completely reformulated according to ordinances stated by Luftfartsstyrelsen. The ordinances propagated for a constitution of an operations manual for air traffic navigation services and were accompanied with strict and detailed guidelines: the regulations would be divided into six sections. A new opera-tions manual was released in 2003 and, except for local variaopera-tions, the structure has been kept since then.

(18)

8

In 2004, the EU formulated four fundamental regulations that still have a huge impact on the content of the set of regulations. They concerned: management of air navigation services within EU, use of air space, use of communication sys-tems, and a flexible and shared use of military-and civil air space. In 2009, the former regulator was reorganized and renamed as Transportstyrelsen. The same year, EU introduced a demand of certification process that concerned each provider of navigation services. The certification was conducted by Transport-styrelsen, and former ordinances of the operations manual from Luftfartsstyrel-sen were dropped. The new guidelines were less strict and requested an opera-tions manual that would include all the procedures necessary for the perform-ance of navigation services.

Today ICAO issues constitutions to all its members with the purpose of strengthening aviation cooperation between its countries. Standards and rec-ommended practices are formulated in documents and annexes such as Doc 4444 and Annex 11. Member states like Sweden are obliged to follow the docu-ments once they have signed the Chicago Convention. Additionally, this state-ment must be collected by the Swedish Aviation Ordinance (TSFS) in order to establish the juridical issue. This is done by Transportstyrelsen and also ac-counts for the Annexes that will be valid in Sweden, and for example, inserted into the Aeronautical Information Publication (AIP). With permission from ICAO it is possible to request variations from the Annexes. Variations from the standards are frequently requested by member states and have led to Eurocon-trol’s establishment of Single European Sky. Single European Sky emphasizes a shared air space and straight air ways that will be used independently of

(19)

9 tional borders.

The previously mentioned cooperation has taken the regulation of rules to a European level, and the EU continuously releases regulations and directives. Regulations have an immediate effect and cannot be overridden by any Swed-ish law. Large parts of the regulations are European applications of ICAO's documents and annexes. Directives are, on the other hand, less strict and give Transportstyrelsen a period of three years to realize and formulate them in TSFS. The extent of regulations is currently getting larger and replaces parts of the old Swedish regulations. National authorities are gradually getting less in-volved in the constitution of rules and the future role of Transportstyrelsen will be debated. For LFV, the ongoing cooperation with Naviair (Denmark) is the top priority in order to be an efficient Air Navigation Service Provider, and the creation of the Nordic Unified Air Traffic Control (NUAC) is a significant step where the need for harmonized and common documentation and streamlined ways of operate is a prerequisite. Moreover, the European Aviation Safety Agency (EASA) has a vision to provide the members of the EU with a common set of regulations: Standardized European Rules of the Air (SERA). Figure 1 il-lustrates the current structure of the rule management.

(20)

10

3 _{Theoretical Framework}

The theoretical framework that will be presented is divided into three parts, each with a specific purpose. The first part aims at introducing the reader to system view that permeates the whole study. This is done with aid of theories of: Accident models, Complex Systems, Common Ground, Human Error and the theory of Sharp-and Blunt end. The second part accounts for the central concepts of the risk-and the safety approach known as Resilience Engineering. Ultimately general research about the use and formulation of procedures will be presented.

3.1 Accidents Models

Hollnagel (2004) divides the models into three main groups: sequential models, epidemiological models, and systemic models. According to the sequential models, an accident is the last outcome in a row of individual events that are perceived as normal. The sequence has initially been triggered by an

unexpected event and the aim is to identify the cause-effect steps in (as the name indicates) chronological order. In the absence of parallel connections, the sequence of events can be represented graphically, and by doing so increases the chance to reveal hidden causes within the chain. The principle has been illustrated with the domino metaphor in which lined up domino blocks represent involved accident factors that contribute to the final outcome (the accident) by falling. Unless there are no barriers placed in between the blocks to stop the fall, a block will immediately affect the next coming block.

Epidemiological accident models take the sequential model to a higher level based on the idea of a disease and its ability to spread itself. The sequence of events is a combination of a certain amount of latent factors, such as a mistake caused by the user, environmental issues, barriers and latent conditions that occur in the very moment. The interaction of the factors may result in an

accident in which the effects are measurable. The model seeks to find carriers of the latent factors and the errors that arise in the system. The Swiss Cheese metaphor developed by Reason (1997) is an example of the approach that intends to illustrate how a certain combination of holes in the barriers may result in unwanted events.

(21)

11

Unlike previous models, accidents according to the systemic model do not have a structural construction. They should instead be considered as normal events in a system. The approach focuses on the control over the system performance and analyses should be based on functions in the system rather than internal mechanisms. There will always remain variability within the systems and the model suggests a continuous control of it. Users of the model investigate accidents by searching after the occurrence of normal and abnormal conditions which through experience they know can lead to unwanted outcomes. An example of such a model is the Functional Resonance Analysis Method (FRAM) in which each function of a system is defined, and evaluated, and

interconnected to the other functions.

3.2 Human Error

An ongoing debate within the field of human factors deals with the use and ap-plication of the concept of human error. The field has until recently been domi-nated with the well-established approach that human errors are intended ac-tions incorrectly carried out by the operator which results in an accident or in-cident. Statistics from relevant domains such as transport and medicine tell us that 80-95% of the accidents are said to be caused by human errors. According to a categorization presented by Isaac & Ruitenberg (1999), human errors arise in two ways: either when making an incorrect action or when failing to act when it is required. Errors are the results of poor cognitive performance and caused by limited information processing including perception and decision-making.

Hollnagel (1983) dismisses the use of the term and argues that it is neither an observable activity nor the result of an intention. Subtitles such as “accident caused by human errors”, often written in the newspapers do not provide us with any information about an accident which instead remains unexplained. The use of the word varies from time to time and refers to inexplicable errors that are assumed to be pure actions of the operator. The conclusion of this rea-soning is that future accidents could never be prevented because of the simple fact that we cannot change human nature. Furthermore, it holds the operator responsible for a problem that might have occurred long before she or he en-tered the system. Analyses of unwanted outcomes should instead be derived from the study of mechanisms behind a normal action and focus on the poten-tial mix of external and internal causes such as bad design or stress. Analysis in this direction would also allow us to examine the interaction between human performance variability and environmental limits rather than the characteristics of the operator.

(22)

12

3.3 Sharp-and Blunt End

In order to study the origin of events and accidents from a whole system view, the theory of sharp-and blunt end connects the epidemiological and systemic model together (Hollnagel 2004). As illustrated in Figure 2, the model describes the unavoidable relation and affection between different levels of an tion. The blunt end refers to people working in the higher levels of an organiza-tion such as management, whose main duties are to distribute resources. Opera-tors, for instance pilots or docOpera-tors, are found in the sharp end, practicing in the environment where risks and accidents arise. The work conditions and per-formance of the operators are indirectly affected by the blunt end through ear-lier decisions and resources provided. It is not unusual that the operators at the sharp end are held responsible for accidents because of their presence in the situations where accidents take place. However the cause of an event can be traced to higher organizational levels where it may have arisen long before it reached the sharp end, through complex interconnections of multiple factors rather than simple cause-event explanations. In addition, the author sustains that none of the concepts are definite, but that each person’s blunt end is some-one else’s sharp end.

Cook and Woods (1994) present three factors that affect the context in which performance at the sharp end takes place. Knowledge factors concern knowledge,

obtained through training and practice, which is crucial to solve problems. At-tentional dynamic factors deal with attention, focus, and the possibility to adjust the workload as a situation changes over time. Strategic factors are related to the operator’s ability to cope with conflicting goals, especially when there are un-certainty, pressure and limited resources. None of the factors are expected to be found in each operator, but are distributed over all practioners and artifacts in the workplace. Neither can they be separated since the performance of a system depends on their interrelations.

(23)

13

3.4 Complex Systems

The complexity of a system and the potential for a severe accident to arise from it can be defined through a classification based on the concepts coupling and in-teraction. Interaction refers to a connection that arises between functions and parts in a system and could be of either linear or complex kind. In linear interac-tion are the parts contribute to the system output, lined up in a predetermined sequence. The pattern makes the interaction predictable and gives the operator, in the event of failure, the possibility to identify the problem but also good op-portunities to fix it, regardless of how many components exist in the line. Inex-perienced personnel might perceive a system as linear while getting more in-volved with it, but have greater opportunity to reveal interactions that are un-expected (Perrow, 1984). Complex interactions are linked without intention and arise in unexpected sequences without have being designed into the system. Thus they are invisible and caused by loops and jumps between linear se-quences. Components, so-called “common mode functions” with multiple pur-poses also contribute to the complexity of a system with unanticipated interac-tions that grow exponentially.

Couplings are connections that exist within a system or organization. A tight coupling means that no space is left between two parts that mutually affect each other if something happens to them. A loose coupling, on the other hand, refers to a slack between the parts, but should not be confused with an absolute lack of connection. What characterizes tightly coupled systems are restricted time limits that the processes depend upon and predetermined sequences of which the order never can be changed. There is also the inability to reach goals in other ways than the intended one and to replace operators or equipment

(24)

14

out a system shutdown. A tightly coupled system can recover itself if extensive buffers and redundancy have been designed into it.

In contrast loosely coupled systems allow for delays in the production, changes of sequence order, and other methods in order to sustain production and to substitute resources. Properties like these encourage flexible production and rely on the actors’ ability to perform work that is based on experience and inter-est. Therefore, they should not be confused with inefficiency or disorganization. A conclusion, stated by EUROCONTROL (2009), is that Air Traffic Manage-ment, found in quadrant number two in Figure 3, will not be well-supported by existing accident models and is therefore considered as the area of interest for Resilience Engineering. The categorization, however, is neither absolute nor constant, systems are not completely complex or linear, nor are they unchange-able. Perrow (1984) writes that air traffic control management has gone from be-ing a complex to a more linear system through successful organization and modern technology. In spite of increased density of traffic dependence between multiple functions has decreased thanks to successful division of the air space, introduction of standardized routes, and increased number of beacons. Techno-logical devices such as radar and transponders have facilitated the work and decreased common-mode failures by providing the controllers with useful in-formation that before had to be exchanged via radio contact. Perrow (1984) ar-gues that the system is moderately tightly coupled. The three dimensional space makes it possible to redirect airplanes and cope with delays, a kind of recovery that loosely coupled systems can achieve, despite their strict limits. The domain is however stained with features of nonlinearity and tight coupling. The system contains a high amount of variables whose interactions cannot be completely prevented: substitution of personnel and equipment, feedback loops, and prob-lems with isolation of functions.

3.5 Common Ground

Woods et al. (2005) define common ground as the knowledge, beliefs and as-sumptions that are obtained and shared among a lot of people within a specific context or domain. Common ground is often visible in conversations that are free from ambiguity and interpreted correctly and understood by the members, even though they are expressed in abbreviated form. The quality of common ground depends on the practitioners and their intentions for communication. Gestures such as simple nods may be sufficient as confirmation in a conversa-tion between two persons that are chit-chatting, while agreements on a higher level require a more explicit and precise understanding. The mutual knowledge does not, however, imply that the participants share neither the same goals nor the same kind of thinking. Common ground should instead be considered as a communication process in order to test, update, and repair the understanding within a team. Mutual knowledge includes information and comprehension of

(25)

15

people’s different work conditions. All members do not only have different roles and duties that are aimed at diverse goals; moreover their ability to cope with time pressure, conflicting goals, and level of fatigue differs. The authors write that initial common ground treats conventions and earlier obtained knowledge that exists within the domain. Specific procedures and information about the members in terms of their knowledge and background are also in-cluded. Public events refer to the knowledge of the event history, and informa-tion that the members have obtained through previous experience which is es-sential in the present activity. Common ground can be supported through a various number of actions including structuring preparations and to constitut-ing routines. Furthermore, Common ground varies over time and is never per-fect but can be kept within acceptable limits through reminders and clarifica-tions and control when it is being compromised. Other essential activities in-clude: updating each other about changes, detecting the deviations that may contribute to a loss a common ground, and in case of loss to repairing the dam-age.

An example from the air traffic control domain illustrates how wrong assump-tions about people’s knowledge can lead to common ground breakdown and unwanted outcomes. The case concerns a flight between Dallas and Miami that had to be redirected because of bad weather. The dispatcher, responsible for the flight, rerouted the flight in agreement with the captain of the aircraft, informed the air traffic control (ATC), and dropped the case convinced that the task was solved. The flight was moved from one sector to another within the air traffic control, but the receiving control was not, as the captain assumed, aware of the weather conditions and rejected the new plan. The involved parts thought that they all were striving towards the same goals with a common picture of the cur-rent situation, but did not make any attempts to confirm their assumptions about the other’s knowledge. As a consequence of this miscommunication, wrong actions were taken, and the circling aircraft run on low fuel and had to land immediately.

(26)

16

3.6 Resilience Engineering

The concept resilience has been used among many domains engineering, ex-pressed as a material’s ability to recover itself after deformation (Woltjer et al., 2010). In line with this, Hollnagel and Woods (2006) suggest a broader approach that also includes the central concepts of foresight and coping. This paradigm for safety management intends to improve socio-technical system’s capacity to cope with complexity and varying conditions in a successful way.

The history of the accidents from Three Mile Island, Chernobyl and the space shuttle Challenger have revealed the need for human factor methods. Tradi-tional accident models have a tendency to simplify interactions thus causing the inability to reveal the underlying multiple-factors and account for the perform-ance found in socio-technological systems (EUROCONTROL, 2009). It is fur-thermore focused on the prevention of things that go wrong while Resilience Engineering seeks to complement existing methods with a focus on the things that go right. Hollnagel and Woods (2006) argue for a shift from theory of error to theory of action which encourages learning driven by the study of successful sys-tem performance rather than the evaluation of accidents and syssys-tem failure. Adapting this thinking, safety can be regarded as the absence of events and the hallmark of functioning, although the occurrence of an event does not necessar-ily imply failed safety. In other words the increase of desired outcomes would automatically imply a decrease of unwanted outcomes. Moreover, safety should be considered as something that a system or an organization does through hu-man perforhu-mance rather than a core property.

Consequently we are left with the challenge of measuring safety in terms of its pure potential through careful monitoring rather than introduction of barriers and procedures (Hollnagel & Woods, 2006). Resilience Engineering expresses a necessity to permeate the whole organization with safety, including economy and business processes (Eurocontrol, 2009). Because of conflicting goals, trade-offs constitute a part of the performance that will concern either the blunt end in the meaning of management and system development or the operator work at the sharp end (Woltjer et al., 2010).

“Resilience is the intrinsic ability of a system to adjust its functioning prior to, during, following changes and disturbances, so that it can sustain required operations under both expected and unexpected conditions” (EUROCONTROL, 2009).

(27)

17

3.6.1 Threats

Control is independent of domain, threatened by conditions such as lack of time, resources, knowledge, and competence. Westrum (2006) argues that resil-ience is best achieved if the threats that challenge the system can be identified; he highlights three aspects of threats; predictability in terms of frequency, po-tential of disruption, and whether their origin is of external or internal charac-ter. Based on those features a division of three groups can be formed; regular threats occur so frequently that a standard response can be formulated to elimi-nate them, but this does not imply that the threat is less severe. An internal threat usually does not jeopardize the whole system function whereas the ex-ternal one requires more extensive measurements. Irregular threats are often un-derstood and triggered by the combination of many low-probability events. Un-expected threats are unpredictable in that they demand an approach that differs from the normal behavior of the system. In spite of this, basic abilities such as self-organization and monitoring will allow one to tell whether a system can re-cover itself effectively.

3.6.2 Performance Variability

Performance variability is a central part of resilience engineering and further-more a natural and inevitable part of a system or an organization. Performance variability should be encouraged but still controlled rather than guarded against. Variability addresses the flexible behavior of people that adjust their performance in order to cope with limited resources and to meet the demands of a system. A system’s performance varies and it is essential to understand its functioning in order to behave in an appropriate manner when control is lost. An increase of this flexible performance is, for instance, crucial when working with imperfect systems, procedures, and instructions that always will be insuf-ficient and underspecified (Woltjer et al., 2010; EUROCONTROL, 2009). The challenge is to understand unanticipated variability by defining the boundaries in which the required performance takes part (Woltjer et al., 2010). Woods (2006) defines this as a competence envelope and holds that the awareness of its boundary and constantly changing demands can be met through monitoring and support of cognitive processes rather than the constitution of rules and procedures.

“The ways in which individual and collective performances are adjusted to match cur-rent demands and resources, in order to ensure that things go right” (EUROCON-TROL, 2009).

(28)

18

3.6.3 The Four Cornerstones

Safety is achieved through the actions of a system and can, through control of the four cornerstones, be maintained in a system. The cornerstones express the abilities to adjust the functioning over time by considering the past and present, and suggest a set of requirements of practical performance that an organization needs to meet in order to regard itself as resilient. It is crucial to understand the importance of the interrelations and couplings between the four abilities and that they should never be studied in isolation from each other. However, it is important to determine the need of each ability in relation to the specific do-main (Hollnagel 2010; Dekker et al., 2008).

Respond

The ability to address the actual is crucial for the survival of a system and re-quires the knowledge to handle and respond to regular and irregular disrup-tions that occur in the system. This can either be done through adjustments of the normal functioning or thorough preparation of predetermined responses. Abilities that underlie the action of response are detection and recognition of an unwanted outcome but also include a sensibility that indicates when and how to respond. An additional challenge is to fit this within a given time horizon and in relation to the resources available.

Monitor

Addressing the critical is to monitor the systems performance as well as the en-vironment that surrounds it; this means to detect disturbances through so called leading indicators that have the potential to affect the current or future produc-tion of the system. A flexible monitoring is achieved through the identificaproduc-tion of so-called “leading indicators” which are subtle signs that hint of upcoming events.

Anticipate

To address the potential is to predict future changes that may arise and affect the organization in both negative and positive ways. An important aspect of this ability is to adopt a wide approach of thinking that reaches outside the tradi-tional boundaries that are often dominated by accident statistics and detection of known hazards and threats. Anticipate can easily be confused with monitor-ing but ranges over a long time and is concerned with the type of irregular threats, while monitoring deals with shorter time horizons and regular threats.

(29)

19

Learn

To address the factual is to use knowledge from past events in the right way. It must be stated not only how often learning will take place and if it is continu-ous or discrete, but also from what experiences that learning will be driven. Moreover it is necessary to make the distinction between what is easy and meaningful to learn from and not be blinded by statistical data of events. The events may be associated with success as well as failure but the essential part is to understand why an event did occur and to learn from the changes that were introduced afterwards. Unless no behavioral changes are made then there are reasons to suspect that nothing has been learnt. A third aspect is how learning should be manifested within an organization. It is a matter of balancing the re-sponsibility of learning between the individual and institutionalized education.

3.6.4 The ETTO Principle

Hollnagel (2009) explains that the complex nature of the systems used today mean that we have to face situations with rapid changes that to a certain point never can be fully described. A mismatch between available time and resources leads to a growing uncertainty that in turn may result in risk taking. If a task is not formulated with respect to strict limits or if the amount of information is provided not is enough, there must be a compromise between what must be done and what should be done. Lack of time can rarely be changed, so what is left is a trade-off between time and resources spent on preparing for an action versus the time and resources spent on carrying it out. Every activity requires some kind of minimum information and efficiency, which people try to acquire, and this can be described and studied with the trade-off between thoroughness and efficiency. Efficiency is to meet the goals with as little investment and re-sources as possible. It is carried out unconsciously and is based on experience. Thoroughness, on the other hand, implies a certainty and requires all resources available in order to bring out the wanted outcome without any side-effects. Al-though a balance between the concepts is desired, it is more common that effi-ciency is chosen over thoroughness because of demands on high productivity. This may result in lost control because wrong actions are carried out or not handed out with respect to the conditions. Thoroughness can be reduced when

high safety is required, but this may result in actions which are too late. The

trade-off is a part of daily activity, and studies of the phenomena may help us to better understand how and why people act in certain ways.

(30)

20

3.7 Procedures

Rule management in relation to safety within organizations is a highly debated topic, and opinions differ strongly in manner of purpose, implementation, and required compliance. Participants of the discussion are grossly divided into two camps, whereas one withholds a scientific-rationalistic approach (Hale et al., 2003). Not following procedures is a threat to safety, or the other way around; safety is the result of people following procedures. The aviation domain is known for adopting this approach, and management does often prevent reoc-currence of accidents through change and introduction of new rules and proce-dures (Dekker 2001, 2003). The attitude is based on the following assumptions: procedures present the optimal way to carry out a task; reliance on a “if-then” structure; and the responsibility to invest in people’s knowledge of procedures and monitoring rule compliance lies on the organization, (Dekker 2001, 2003). Isaac and Ruitenberg (1999) claim that complex human-machine systems are in a need of procedures to maintain safety and efficiency, since human perform-ance is variable and can lead to errors. The purpose of standardizing proce-dures is therefore to support the operator by reducing his or her variability. The awareness of increasing complexity within socio-technological systems has led to the evolution of a contradictory stance: that safety can be achieved if peo-ple understand that procedures should be used with respect to specific condi-tions in a situation. According to this approach, procedures are resources for ac-tion, and pure application of procedures is not necessary to enhance safety or the most sufficient way to carry out an action (Dekker 2001, 2003). Instructions will always be incomplete and can at best account for a detailed accomplish-ment of a task in very simple situations (Suchman, 1987).

3.7.1 Procedures and Practice

By introducing the concept of plans and situated actions, Suchman (1987) em-phasizes the flexibility of human intelligent action when facing the gap between a plan and the actual situation. The gap is a construct of material and social cir-cumstances. The statement is as follows: human action performed in situ is based on experience to match current conditions rather than guided by the pre-determined performance expressed in plans. The plan serves as an artifact of our reasoning about action and the action is the mean between the plan and cir-cumstantial conditions. Therefore the initial plan is often abandoned at an early stage and undergoes a constant modification as the situation changes.

(31)

21

Cognitive science maintains that it is possible to overcome the vagueness of procedures with improved and more intelligible plans. Situated action states in-stead that this kind of insensitivity to context in representational schemes may constrain the possibilities of action. A plan should rather be regarded as a rep-resentation of action and that improvement should be realized through exami-nation of what kind of resource the plan actually is. To judge the current situa-tion is a difficult task that leaves an operator with two types of potential fail-ures: to either fail to adapt or attempt adaptations that fail (Dekker, 2001, 2003). The former failure is caused by the people’s inability to interpret a rule with re-spect to the actual situation. It is a matter of rigid rule obedience that from this point of view is considered inefficient and unsafe (EURCONTROL, 2009). The latter failure regards those situations when operators deviate from regulations without having obtained enough knowledge about the new conditions. The failures can, however, be mastered trough a supportive organization. Apart from regular monitoring and increased understanding of the gap, operators should be encouraged to develop the cognitive skills necessary for judging when adaption is appropriate. Pritchett and Ockerman (2000) write that proce-dural failure can also be dealt with by controlling the grade of details, and to reduce them in situations when the user needs to rely on experience.

Earlier research proves that the need for procedures depends on the work tasks and experience of an operator (Lawton&Parker, 1999; Grote et al., 2009). A study by Law and Parker (1999) shows, for instance, that junior medical staff were in greater need of protocols while more experienced staff relied on infor-mation that was already in their heads. Furthermore, nurses and doctors ap-plied the procedures in different ways. Hale and Swufte (1998) also observed a similar tendency within a railway company where different professions re-quested different amounts of specifications within the rules. In this case, there was a correlation between rule application and the responsibility of action.

3.7.2 Formulation of Procedures

Adequate application of procedures depends on the content, and the physical structure, and organization of rules (Pritchett & Ockerman 2000). The size of a rule set has significance and constant growth may be the result of supplements to “incomplete” rules (Hale & Swufte, 1998). Rules distributed over many vol-umes may also complicate update of the content and the risk to miss any of the parts increases. Furthermore, such a distribution has a tendency to confuse the reader when there is a need to jump between the steps of a procedure. It is a common problem for an element of a procedure to be related to a separate document, which causes the difficulty of combining different documents when working. The prescriptions of operations manuals, procedures, rules, and task planning often conflict with each other.

(32)

22

These kind of conflicts not only arise because of the different nature of the documents but also because they have been written by people with diverse per-spectives from different organizations whose interests target separate parts of the organization (Carvalho et al., 2006 ; Lawton & Parker, 1999).

Also, textual content plays a role since comprehension of a procedure is based on the skill to read and translate the text into a representation of an action (Pritchett and Ockerman 2000). Comprehending and interpreting the language

of the procedure makes up a large part of the overall understanding. A study

conducted by Carvarlho et al. (2006) revealed the necessity of understanding the meaning of a rule and that rules presented with reasons and explanations regarding the execution could facilitate decision making, especially in situations with conflicting rules. Lack of explanations put high demands on procedure us-ers and the study showed that it required complex cognitive strategies in order to make sense of the rules they were left with. Yet results showed that operators succeeded to overcome these difficulties through close collaboration manifested in verbal exchange that included continuous feedback and shared knowledge. Grote et al. (2009) argue that a proper balance between standardized and flexi-ble rules can push a high-risk organization towards the characteristics of such a loosely coupled system that has been defined by Perrow (1984). The decision latitude in turn depends of the uncertainty in the environment. This can be dealt with in two suggested ways: either to minimize or to cope with uncertain-ties. By minimizing the uncertainties, one reduces the operative degrees of free-dom through automation and procedures. Coping with uncertainties means to use procedures as sources for action in order to support maximization of opera-tive degrees of freedom. Through a categorization of rules, three different types of procedures can be identified and examined within an organization: goal rules, process rules, and action rules. Goal rules describe a goal in wide terms and do not specify any certain way in which the rule could be brought out or followed. Process rules intend to account for the processes necessary to achieve a goal and supply the user with a guidance of methods. Action rules are the most specified ones and provide the user with detailed information about how an action will be executed. The division of rules has in combination with earlier findings led to the following proposal: that rules are best applied when the user has taken part in the formulation. Formulation of rules can then be realized by the “right” person by letting each abstract level of rules respond to the levels found in the hierarchy of an organization. Goal rules should be constituted in the higher levels of an organization and translated into more concrete process rules on the levels below and finally obtain detailed descriptions when reaching the user. In addition, this successful implementation of procedures can be in-creased if the user takes part in the formulation (Grote et al., 2009). It is how-ever common that the construction of rules is derived from the operators when established work practices become rules (Felici et al., 1998). The study con-ducted at Rome Airport revealed that operators gave all approaching aircraft the very same flight level because it appeared to be a convenient practice for pi-lots and controllers. This method of work ended up in the airport’s set of in-structions as an established procedure.

(33)

23

4 _{Research Method}

The purpose of this study is to account for administration and implementation of the set of regulations used at LFV. It can be described as a field study with a qualitative approach. A qualitative approach is appropriate in order to capture sociological aspects and interaction between people in the entire organization. With an ethnographic approach, data was obtained from documents provided by LFV, observations in the aerodrome, approach and area control, and

interviews with air traffic controllers and domain experts responsible for the rule management.

4.1 Ethnographic Method

Analysis of the data is based on the basic ideas of Resilience Engineering and emphasizes the study of normal performance. Ethnographic methods are suit-able for examining behavior in daily activities and fulfill this purpose (Cuvelier & Falzon, 2008; Cox et al., 2007). Additional interests in this study include the mismatch between work as imagined and practiced (Hughes et al., 1997) and the gap between implementation and procedures. Research has moreover proved that the approach is favorable in the examination of the domain of air traffic management (Cox et al 2007; Sanne 1999). Through studies in the London Air Traffic Control Center, details were discovered regarding the interaction and work between the operators that were undiscovered from task analyses con-ducted in the same setting (Hughes et al., 1995). Segelström et al. (2009) point out that the hallmarks of the method are difficult to unite within service design; to speak the local language and to participate in the studied setting. Neverthe-less, they prove that the criteria can be met through appropriation of the ethno-graphic situation. Also, Hughes et al. (1994) showed that an ethnography can be modified according to the study of interest and proved that one should not be afraid of deviating from the classical view. The method is usually applied in small scale settings, but a study of a business Center conducted by Hughes et al. (1997) revealed that the approach also can be beneficial in the study of larger re-search sites such as whole organizations.

(34)

24

4.2 Data Collection

With respect to the main purpose to bring out pure opinions about the set of regulations, the data in this study is collected from interviews rather than observations. Furthermore, implementation of procedures deals with implicit information that is difficult to reveal through observations. The processes to collect and analyze the data have been performed side by side in order to focus and afterwards confirm detected features in the research context. The study was performed in two separated parts with an introduction moment regarded as an exploratory study in order to familiarize with the air traffic controllers and the environment in which they are operating. Without this knowledge and valuable access to the language and terminology used by the operators in the site of interest (Patton, 2002), it would have been very difficult to conduct this study. A further reason for this simultaneous data collection and analysis was to find out what kind of interview questions would bring out the most relevant and fruitful answers with respect to the questions of issue. Two different guides were

initially formulated and tested on different respondents. The guides were thereafter revised and adjusted according to the new topics that were raised by the respondents.

4.2.1 Sampling

The administration and implementation of regulations permeates a whole organization, and it was necessary to reveal opinions from employees that represent different parts and levels of the organization LFV. Interviews were therefore performed with air traffic controllers and domain experts that are responsible for the formulation of the set of regulations at LFV. A couple of the informants held several roles within the organization and could account for the constitution of rules as well as the core implementation of them. The method of selection differed and some air traffic controllers were chosen by their

supervisor, whereas others were chosen because of their pure availability, according the method of convenience sampling (Patton, 2002). It was also relevant to identify potential differences between novices and experienced operators, whereby newly examined students were included into the group of informants. The two airports that were visited during this study were

(35)

25

4.2.2 Observations

The observations in this study were combined with an informal conversational interview, also know as an “unstructured interview”, which allowed the

researcher to participate to a great extent as an so-called “onlooker” without getting involved in the actual performance, (Patton, 2002). The technique suited the study well since it enabled the researcher to generate questions

spontaneously in the context of where the subjects were found (Patton, 2002). The study included two observations, whereby the introducing one was performed with an open-minded stance at a smaller airport. The questions asked concerned general knowledge in order to get an overall understanding of the work as an air traffic controller. First during the second observation

conversations with the operators could be focused on regulation-related topics. Field notes were written down sporadically during the sessions, although with carefulness. There is a tendency to overgeneralize features in a field setting, and a clear distinction between descriptions and interpretations must be stressed in the field notes (Patton, 2002).

4.2.3 Interviews

In total, twelve interviews were conducted and performed in the normal environment of the respondents, the two air navigation sites that were visited. All informants were given both verbal and written information regarding their participation in the study such as anonymity requirements and their right to disrupt the interview. Permission to record the interview with an mp3-player was also requested before the session could begin. Two different interview guides were prepared and adjusted to the two groups of interviews, but the main structure was kept in both guides. Interview guide 1 (see Appendix A) aimed at revealing core opinions about the existing set of regulation and was used with the operators, while interviews with the domain experts were more focused on the core formulation of the rules and the participation in the

formulation process (see interview guide 2 in Appendix B).

All interviews were performed according to the structured interview (Patton, 2002). Questions within the same topic were listed, but the order in which they were asked depended on the directions of each interview. The technique was

chosen in order to let the respondents raise andreason about other relevant

topics than those predetermined. An open-minded approach was crucial since the study aimed at revealing the respondents opinions and perceptions about the topic in general, rather than treating specific interests from the interviewer (Patton, 2002). The guide contained exclusively open-ended questions (Patton, 2002) and the respondents were free to answer in their desired way and not limited to predetermined answer alternatives. Few notes were taken because the technique requires a lot of attention on the informants in order to ensure that relevant topics were discussed during the interview.

(36)

26

The air traffic controllers had to dedicate their breaks and the interviews were automatically adjusted to the time available and were limited to a duration of 30 minutes. Because of a loss of data, follow-up interviews on phone where held with a subsample of the air traffic controllers to ensure that the

information obtained during the interviews was completely understood. This interview technique is a suitable way to strengthen the quality of the data (Patton, 2002 ; Cox et al., 2007), and also provides the opportunity to dig deeper into relevant topics that have been raised. Follow-up interviews serve

furthermore as an indication of the researcher’s genuine interest in the

responses given by the informants, (Patton, 2002) and the informants that took part in the follow-up interviews showed a different understanding for the topic and could deliver fruitful answers the second time they were asked. Phone interviews were also conducted with the domain experts that were provided in advance with a summary of the topics that would be raised during the

interview. The purpose was not only to compensate for the particular kind of interaction, which arises in face-to-face sessions, but was also aimed at giving the respondents time for preparation and the opportunity of reflection prior to the interviews. The interviews lasted 25-45 minutes.

4.2.4 Results and Analysis

Field notes taken during the observations were rewritten shortly after each visit in order to avoid what Patton (2002) calls memory reconstruction. Recorded data from the interviews were transcribed according to Linell’s (1994) definition of level three: a level that should be considered as a detailed documentation of recorded data. The transcribed material presented in Chapter 5 is structured ac-cording to the design of the interview guide. In order to describe trends and nuances at a more detailed level, parts of the data have been divided into sub-categories. The results were furthermore analyzed with aid of the theoretical framework of procedures and Resilience Engineering.

Rules in Heaven : A closer look at a set of regulations for air navigation service from a Resilience Engineering perspective

MAGISTRATE THESIS IN COGNITIVE SCIENCE

RULES IN HEAVEN

A closer look at a set of regulations for

air navigation service from a

Resilience Engineering perspective

Acknowledgements

Abstract

Contents

Figures

Terminology

1

Introduction

1.1

Purpose

1.2

Clarifications and Restrictions

2

Background

2.1

Safety

2.2

Synergi and Trend Analysis

2.3

Entry Point North

2.4

Operations Manuals

2.5

The Origin of Regulations

3

Theoretical Framework

3.1

Accidents Models

3.2

Human Error

3.3

Sharp-and Blunt End

3.4

Complex Systems

3.5

Common Ground

3.6

Resilience Engineering

3.6.1

Threats

3.6.2

Performance Variability

3.6.3

The Four Cornerstones

3.6.4

The ETTO Principle

3.7

Procedures

3.7.1

Procedures and Practice

3.7.2

Formulation of Procedures

4

Research Method

4.1

Ethnographic Method

4.2

Data Collection

4.2.1

Sampling

4.2.2

Observations

4.2.3

Interviews

4.2.4

Results and Analysis

_Introduction

_Background

_{Theoretical Framework}

_{Research Method}